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Introduction 


The Information Commissioner (the Commissioner) is calling for evidence 
and views on the Age Appropriate Design Code (the Code). 


The Code is a requirement of the Data Protection Act 2018 (the Act). The 
Act supports and supplements the implementation of the EU General Data 
Protection Regulation (the GDPR). 


The Code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. Once it has been published, the Commissioner will 
be required to take account of any provisions of the Code she considers to 
be relevant when exercising her regulatory functions. The courts and 
tribunals will also be required to take account of any provisions they 
consider to be relevant in proceedings brought before them. The Code 
may be submitted as evidence in court proceedings. 


Further guidance on how the GDPR applies to children’s personal data can 
be found in our guidance Children and the GDPR. It will be useful to read 
this before responding to the call for evidence, to understand what is 
already required by the GDPR and what the ICO currently recommends as 
best practice. In drafting the Code the ICO may consider suggestions that 
reinforce the specific requirements of the GDPR, or its overarching 
requirement that children merit special protection, but will disregard any 
suggestions that fall below this standard. 


The Commissioner will be responsible for drafting the Code. The Act 
provides that the Commissioner must consult with relevant stakeholders 
when preparing the Code, and submit it to the Secretary of State for 
Parliamentary approval within 18 months of 25 May 2018. She will publish 
the Code once it has been approved by Parliament. 


This call for evidence is the first stage of the consultation process. The 
Commissioner seeks evidence and views on the development stages of 
childhood and age-appropriate design standards for ISS. The 
Commissioner is particularly interested in evidence based submissions 
provided by: bodies representing the views of children or parents; child 
development experts; providers of online services likely to be accessed by 
children, and trade associations representing such providers. She 
appreciates that different stakeholders will have different and particular 
areas of expertise. The Commissioner welcomes responses that are 
limited to specific areas of interest or expertise and only address 
questions within these areas, as well as those that address every question 
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asked. She is not seeking submissions from individual children or parents 
in this call for evidence as she intends to engage with these stakeholder 
groups via other dedicated and specifically tailored means. 


The Commissioner will use the evidence gathered to inform further work 
in developing the content of the Code. 


The scope of the Code 


The Act affords the Commissioner discretion to set such standards of age 
appropriate design as she considers to be desirable, having 

regard to the best interests of children, and to provide such guidance as 
she considers appropriate. 


In exercising this discretion the Act requires the Commissioner to have 
regard to the fact that children have different needs at different ages, and 
to the United Kingdom’s obligations under the United Nations Convention 
on the Rights of the Child. 


During Parliamentary debate the Government committed to supporting 
the Commissioner in her development of the Code by providing her with a 
list of ‘minimum standards to be taken into account when designing it.’ 
The Commissioner will have regard to this list both in this call for 
evidence, and when exercising her -discretion to develop such standards 
as she considers to be desirable 


In developing the Code the Commissioner will also take into account that 
the scope and purpose of the Act, and her role in this respect, is limited to 
making provision for the processing of personal data. 


Responses to this call for evidence must be submitted by 19 September 
2018. You can submit your response in one of the following ways: 


Online 


Download this document and email to: 
childrenandtheGDPR@ICO.org.uk 


Print off this document and post to: 

Age Appropriate Design Code call for evidence 
Engagement Department 

Information Commissioner's Office 

Wycliffe House 

Water Lane 

Wilmslow 
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Cheshire SK9 5AF 


If you would like further information on the call for evidence please 
telephone 0303 123 1113 and ask to speak to the Engagement 
Department about the Age Appropriate Design Code or email 
childrenandtheGDPR@ICO.org.uk 


Privacy statement 

For this call for evidence we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 
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Section 1: Your views and evidence 


Please provide us with your views and evidence in the following areas: 


Development needs of children at different ages 


The Act requires the Commissioner to take account of the development 
needs of children at different ages when drafting the Code. 


The Commissioner proposes to use their age ranges set out in the report 
Digital Childhood - addressing childhood development milestones in the 
Digital Environment as a starting point in this respect. This report draws 
upon a number of sources including findings of the United Kingdom 
Council for Child Internet Safety (UKCCIS) Evidence Group in its literature 
review of Children’s online activities risks and safety. 


The proposed age ranges are as follows: 


3-5 
6-9 
10-12 
13-15 
16-17 


Q1. In terms of setting design standards for the processing of children’s 
personal data by providers of ISS (online services), how appropriate you 
consider the above age brackets would be (delete as appropriate): 


Not at all appropriate 
Not really appropriate 
Quite appropriate 
Very appropriate 


Q1A. Please provide any views or evidence on how appropriate you 
consider the above age brackets would be in setting design standards for 
the processing of children’s personal data by providers of ISS (online 
services), 


Sky’s response to this consultation is based on our experience building online 
services and apps specifically designed for children. 


The Sky Kids App was designed with 5Rights principles in mind. It allows parents to 


set up the app with reference to specific age ranges that then corresponds to 
particular content that is suitable for the child using the app. It is highly configurable 
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by parents, for example, parents can select an option that means only channels 
suitable for under-5s can be watched on the app and the child’s date of birth means 
that age appropriate content will be presented for them to watch. 


The app was designed with the principle that children cannot be treated as a 
homogenous group and have different content preferences and developmental 
needs depending on their age. 


There are specific features in the app that allow parents control over their children’s 
use of the Sky Kids service such as sleep mode, which sets time limits on when the 
app can be used and a camera function which controls whether games can use the 
camera on the device. 


The app was designed by children, who had direct input into the development 
process through detailed focus groups and workshops. 


Q2. Please provide any views or evidence you have on children’s 
development needs, in an online context in each or any of the above age 
brackets. 


Sky supports the principles set out in the 5Rights response to this consultation on the 
different developmental needs of children 


In the design of our services specifically for children we took care to accommodate 
children’s differences, both from adults and from each other. Simply putting a new skin 
over our existing design was not sufficient to take account of children’s needs. 


For example in the sign-up process of the Sky Kids app we thought carefully about when 
to give the child control in configuring and when to ask them to ask their parents to 
make specific selections based on their age range. 


Other organisations have done extensive media literacy analysis of the different 
developmental needs of children. For example, Ofcom’s annual child media literacy 
audit is a useful starting point in understanding different behaviours. Internet Matters 
and the 5Rights foundation have both researched different children’s needs and have 
provided responses to this consultation that we endorse. 


The United Nations Convention on the Rights of the Child 

The Data Protection Act 2018 requires the Commissioner to take account 
of the UK’s obligations under the UN Convention on the Rights of the Child 
when drafting the Code. 


Q3. Please provide any views or evidence you have on how the 
Convention might apply in the context of setting design standards for the 
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processing of children’s personal data by providers of ISS (online 
services) 


It seems logical to apply the Convention in the setting of design standards. We support 
the 5Rights Foundation response to this consultation that welcomes the inclusion of the 
UNRC within the code, particularly the clarification that a child is any person under 18 
and that ‘the best interests of the child is the paramount consideration in relation to 
data protection’. We also support their analysis on how to apply the code. 


Aspects of design 


The Government has provided the Commissioner with a list of areas which 
it proposes she should take into account when drafting the Code. 


These are as follows: 

e default privacy settings, 

e data minimisation standards, 

e the presentation and language of terms and conditions and privacy 
notices, 

« uses of geolocation technology, 

«e automated and semi-automated profiling, 

e transparency of paid-for activity such as product placement and 
marketing, 

e the sharing and resale of data, 

e the strategies used to encourage extended user engagement, 

e user reporting and resolution processes and systems, 

e the ability to understand and activate a child's right to erasure, 
rectification and restriction, 

e the ability to access advice from independent, specialist advocates 
on all data rights, and 

e any other aspect of design that the commissioner considers 
relevant. 


Q4. Please provide any views or evidence you think the Commissioner 


should take into account when explaining the meaning and coverage of 
these terms in the code. 


Q5. Please provide any views or evidence you have on the following: 
Q5A. about the opportunities and challenges you think might arise in 


setting design standards for the processing of children’s personal data by 
providers of ISS (online services), in each or any of the above areas. 
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Sky supports the inclusion of all of these areas of design in the code. We are also 
supportive of the 10 Guiding Principles developed by 5Rights in consultation with a large 
number of individuals and organisations across its network. 


Where applicable Sky incorporated these areas into the design process of the Sky Kids 
app. Our key principles in designing the app was that it should be fun, surprising and 
engaging for children, while also being safe, giving them ownership and being forgiving 
of their relative lack of understanding of the ‘rules of the road’ for digital technology. 
The children we consulted in designing the app told us they wanted less complexity, and 
wanted the “fiddliness” taken out of the app. 


On the ‘strategies to ensure extended user engagement’ we would draw a distinction 
between addiction-forming design and habit-forming design. We want to design our 
products to be engaging and fun for children, while allowing them to switch away or 
turn off when they need to. For example, we decided not to include video autoplay as a 
function in the Sky Kids app. We asked children what they wanted as part of the app and 
they told us they didn’t want it. They wanted to feel empowered to choose what they 
want to watch and not to be automatically shown content they might not have chosen. 


There are significant opportunities for online services to protect children from harms 
online. While Sky’s examples do not relate to the processing of children’s data as part of 
an online service, our experience is that involving children in the design process, 
stripping out complexity and building in safety by default means a safer and better 
product. 


Q5B. about how the ICO, working with relevant stakeholders, might use 
the opportunities presented and positively address any challenges you 
have identified. 


Sky would suggest engaging with online services at various points in their design process 
to understand how they think about how children will use their services under 
development. Different organisations will have different approaches, but we suggest the 
ICO encourages children specific design at an early stage instead of retrofitting design 
features onto a pre-existing product. 

Collaboration with groups such as the 5Rights Foundation and Internet Matters should 
be positively encouraged. 


Q5C. about what design standards might be appropriate (ie where the bar 
should be set) in each or any of the above areas and for each or any of 
the proposed age brackets. 


On the specific design standards identified we would suggest that any protective 
features such as privacy settings should be turned on by default. The standard should be 
‘safety by default’, therefore any features such as geolocation should be turned off, and 
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made configurable to either the parent if the child is young, or the child if the child is in 
the oldest age bracket. 


Sky has followed this principle with its broadband parental control tool. This principle 
was supported by the Lords Communications Committee Growing up with The Internet 
report. 


All advertising and marketing within the product should be made clear and transparent, 
with the ICO retaining the ability to independently audit what an online service actually 
displayed to children. 


Parents must be incorporated into the processes for children to report and resolve any 
disputes. A child should also have absolute right to remove any content or profile 
information that relates to them at any time without justification. 


Q5D. examples of ISS design you consider to be good practice. 


See descriptions above 


Q5E. about any additional areas, not included in the list above that you 
think should be the subject of a design standard. 


We would suggest more needs to be done on the actual content presented to 
children as part of these services. Safety must be built in by design and children 
often see content that is unsuitable and harmful for them. We recognise this is 
beyond the remit of this code, but the ICO should share its learnings with the 
Government as part of the internet safety strategy, forming a model for future 
regulatory structures on safety. 


Q6. If you would be interested in contributing to future solutions focussed 
work in developing the content of the code please provide the following 
information. The Commissioner is particularly interested in hearing from 
bodies representing the views of children or parents, child development 
experts and trade associations representing providers of online services 
likely to be accessed by children, in this respect. 


Nome: aa 
Email: I @ sky.uk 


Further views and evidence 
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Q7. Please provide any other views or evidence you have that you 
consider to be relevant to this call for evidence. 


Sky supports the 5Rights response to this consultation and agrees that the 
following 10 Guiding Principles should form the basis of the code: 


1. In determining standards and what measures must be taken, the best 
interests of the child must be the paramount consideration 

2. A high bar of privacy by default; i.e. safety by design, privacy by 
design and high privacy by default should be the norm for all 
products and services’ features and functionalities likely to be 
accessed by children 

3. Responsibility for data protection rests with online services, not the 
child 
Responsibility for enforcement rests with the regulator, not the child 

5. The impact of service design on children (under 18) must be 
considered in advance 

6. The Code must reflect and/or enhance, never lessen, existing 
regulations, legislation, international agreements and cultural norms 
that protect children in other contexts, by incorporating and applying 
them so that they are enforceable in the digital environment 

7. The Code must give clarity to the General Data Protection 
Regulation’s (“GDPR”) assertion that “children merit specific 
protection” 

8. The Code must reflect and address the needs and concerns 
articulated by children themselves 

9. That children have different needs at different ages and stages of 
development and these must be considered when designing services 

10. Online services have a duty to uphold the spirit as well as the letter of 
the Code 
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Section 2: About you 


Are you: 


A body representing the views or interests of children? 
Please specify: E 


A body representing the views or interests of parents? 
Please specify: L 


A child development expert? 
Please specify: E 


A provider of ISS likely to be accessed by children? 
Please specify: Broadcaster and telecoms provider 


A trade association representing ISS providers? 
Please specify: LJ 


An ICO employee? 


Other? 
Please specify: E 


Thank you for responding to this call for evidence. 
We value your input. 


V1.0 20180626 


